CAN-SPAM Act (United States)

If you send commercial email to people in the United States, the CAN-SPAM Act applies to you. It sets requirements for commercial messages, gives recipients the right to make a sender stop emailing them, and sets out the penalties for violations. The Federal Trade Commission (FTC) enforces the Act and the CAN-SPAM Rule that goes with it.

Not legal advice. Check penalties and thresholds against the primary source (below) and with counsel before you rely on them. See compliance/README.md.

What the Act covers:

• Despite its name, CAN-SPAM does not apply only to bulk email. It covers all commercial messages, defined as "any electronic mail message the primary purpose of which is the commercial advertisement or promotion of a commercial product or service," including email that promotes content on commercial websites.
• There is no exception for business-to-business mail. A message to former customers announcing a new product line must comply.
• CAN-SPAM is an opt-out regime. You do not need prior consent to send commercial email, but you must offer and honor opt-outs. Compare this with the opt-in regimes of Canada's CASL and the UK's PECR.

Penalties

Criminal penalties, including imprisonment, apply to:

• accessing someone else's computer without permission to send spam;
• using false information to register several email accounts or domain names;
• relaying or retransmitting many spam messages through a computer to mislead others about where the message came from;
• harvesting email addresses, or generating them with a dictionary attack (sending to addresses made of random letters or numbers in the hope of hitting valid ones);
• using open relays or open proxies without permission.

The seven main requirements

Opt-out mechanics

• The opt-out mechanism must be able to process requests for at least 30 days after the message is sent.
• Opt-out requests must be honored within 10 business days.
• A sender may not charge a fee, require any personally identifying information beyond an email address, or require any step other than sending a reply email or visiting a single web page.
• A preference menu (for opting out of certain types of message) is allowed, but it must include an option to stop all marketing messages.
• Make sure your own spam filter does not block incoming opt-out requests.
• Once someone opts out, you may not sell or transfer their address, even as part of a mailing list. The only exception is a transfer to a company hired to help you comply with CAN-SPAM.
• Subscribers and members can opt out too. A subscription or membership does not remove the right to opt out of marketing email. Before you send a message with no unsubscribe link to subscribers or members, check that its primary purpose fits one of the five transactional or relationship categories below. Otherwise, you must include an opt-out.

Commercial vs. transactional or relationship messages

What the Act covers depends on the primary purpose of the message. An email can contain three kinds of content:

1. Commercial content, which advertises or promotes a commercial product or service, including content on a website operated for a commercial purpose;
2. Transactional or relationship content, which facilitates a transaction already agreed or updates a customer about an ongoing transaction;
3. Other content, which is neither of the above.

If the message contains only commercial content, it is commercial, and all the requirements of CAN-SPAM apply. If it contains only transactional or relationship content, it is exempt from most provisions, but it still must not contain false or misleading routing information.

The five transactional or relationship categories

A message's primary purpose is transactional or relationship only if it consists only of content that:

1. facilitates, completes or confirms a commercial transaction the recipient already agreed to;
2. gives warranty, recall, safety or security information about a product or service the recipient bought;
3. notifies the recipient of a change in the terms or features of a membership, subscription, account, loan or other ongoing commercial relationship, or of a change in the recipient's standing in that relationship, or provides regular, periodic information about an account balance;
4. provides information about an employment relationship or employee benefits;
5. delivers goods or services as part of a transaction the recipient already agreed to.

The FTC reads these categories narrowly. Do not assume that every message to subscribers or members is transactional. The test is whether a reasonable consumer reading the email would understand its primary purpose as fitting one of the five categories.

Mixed commercial and transactional content

The message is commercial for the purposes of CAN-SPAM if either:

• a recipient reasonably interpreting the subject line would likely conclude that it contains an advertisement or promotion; or
• the transactional or relationship content does not appear mainly at the beginning of the message.

An example from the FTC guide: an account statement that gives shipping and payment details first, with a one-line mention of a website at the end, is most likely transactional. The same subject line on a message that opens with promotions and leaves the delivery notice until the end is most likely commercial.

Mixed commercial and "other" content

The primary purpose is commercial if:

• a recipient reasonably interpreting the subject line would likely conclude that the message advertises or promotes a product or service; or
• a recipient reasonably interpreting the body would likely conclude that its primary purpose is to advertise or promote.

The relevant factors are where the commercial content is placed (for example, at the beginning?), how much of the message is commercial, and the use of color, graphics, type size and style to highlight the commercial content.

Who is the "sender" when multiple marketers appear in one message?

When one email advertises the goods, services or websites of more than one marketer, the marketers can designate a single "sender" to be responsible for compliance, provided that the designated marketer:

1. meets the Act's definition of "sender" (it initiates a commercial message that advertises or promotes its own goods, services or website);
2. is specifically identified in the "From" line; and
3. complies with the provisions that apply to the initiator: no deceptive transmission information or deceptive subject heading, a valid postal address, a working opt-out link, and proper identification of the message as commercial or sexually explicit.

If the designated sender fails in these duties, all the marketers in the message may be held liable as senders.

Forward-to-a-friend messages

Whether the seller or the person forwarding is the "sender" or "initiator" depends on the facts, and above all on whether the seller pays or offers a benefit for forwarding. If the seller offers money, coupons, discounts, awards, sweepstakes entries or something similar in exchange for forwarding, or pays or rewards anyone for generating web traffic or any kind of referral, the seller probably has compliance obligations. The UK reaches a similar result through the concept of "instigation" (see UK PECR).

Sexually explicit email

An FTC rule under CAN-SPAM adds requirements for messages with sexually oriented material:

• The subject line must begin with the warning "SEXUALLY-EXPLICIT:".
• The message body must use the electronic equivalent of a "brown paper wrapper". When the message is opened, the only content visible may be the words "SEXUALLY-EXPLICIT:" and the standard disclosures for commercial email (identification as an ad, physical postal address, opt-out procedure). No graphics are allowed on the wrapper, and the recipient must take a deliberate action (scrolling, clicking) to see the explicit content.
• The wrapper requirement does not apply if the recipient gave prior affirmative consent to receive the sender's sexually oriented messages.

Deliverability relevance

CAN-SPAM is a legal minimum, not a strategy for reaching the inbox. The filtering standards of mailbox providers (complaint rates, engagement) are far stricter than opt-out law. Mail that is legal but that recipients never asked for still produces the complaints and low engagement that destroy a sender's reputation. See Foundations of Email Deliverability and Two Worlds of Email Deliverability.